Local sign-in passwords are never recovered. LancerLogin stores a unique-salt, memory-hard scrypt hash (N=32768, r=8, p=1) and verifies it with constant-time comparison. Unknown usernames receive the same scrypt verification work as known users. Five consecutive failed passwords lock that account for fifteen minutes without storing an IP address; a successful sign-in or the local recovery tool clears the failure state. A forgotten local credential is reset only from the interactive local recovery tool using the adopter's scoped D1 authorization; it cannot be emailed or displayed.
Google OAuth is selectable at first setup and is verified server-side in the Worker with signed, expiring state plus issuer, audience, verified-email, and active-user checks. Either method or both may be enabled. Integration settings use an installation-specific 32-byte Worker secret and AES-256-GCM with a fresh IV per save. Dashboard responses return only configuration state and update time, never saved values. Provider test, rotation, and removal controls use the same Admin-only integration capability.
For local sign-in, the Worker issues a signed, expiry-bound session containing only user ID and role. Signatures are HMAC-SHA-256 with an installation secret; tampered and expired sessions are rejected before authorization. Every protected request also reloads the active user and current role from D1, so deactivation or demotion takes effect immediately instead of waiting for the eight-hour session expiry. The generated Pages _worker.js forwards /api/* to the Worker, so the browser keeps Secure, HTTP-only, SameSite=Strict cookies on one first-party Pages origin instead of depending on third-party Worker cookies. Every JSON mutation requires application/json, forcing hostile cross-origin browser requests through a CORS preflight; untrusted origins receive no permission. This also protects the unconfigured first-Admin bootstrap, where no session exists yet. Google uses the same Pages /api/auth/google/callback origin. A Google-only installation refuses removal of its only configured sign-in integration.
Attendance CSV cells beginning with spreadsheet formula markers are prefixed as text before RFC-style quoting. This prevents organization-controlled meeting or roster text from becoming an executable formula when an export is opened in spreadsheet software.
The optional community telemetry collector is isolated from adopter resources. It rejects fields outside the documented five-field allowlist, rejects IP-shaped location text, HMAC-hashes opaque install IDs with a collector-only secret, stores one daily row, and applies edge/global admission limits. Observability is disabled in its generated configuration. Its summary endpoint requires a separate long bearer token and returns aggregates only; metro groups require five distinct installations.